T09 · Insecure Skill Coding Practices
Error
- Location
- src/cli.ts:52
- Finding
- Wallet Passwords and Recovery Mnemonics Can Be Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `src/cli.ts:52-60`, `src/cli.ts:201-207` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: High ### Vulnerable Code ```typescript async function promptPassword(promptText: string): Promise<string> { // For now, use env var or argument - interactive prompt needs enquirer const password = process.env.CLAWPURSE_PASSWORD || getArg('--password'); if (!password) { console.error(`Error: Password required. Set CLAWPURSE_PASSWORD env var or use --password flag`); process.exit(1); } return password; } ``` ```typescript const mnemonic = getArg('--mnemonic') || process.env.CLAWPURSE_MNEMONIC; if (!mnemonic) { console.error('Error: Mnemonic required. Use --mnemonic or set CLAWPURSE_MNEMONIC'); process.exit(1); } ``` ### Technical Analysis The CLI explicitly accepts wallet passwords through `--password` and complete BIP-39 recovery phrases through `--mnemonic`. Process arguments are not an appropriate secret-transport mechanism because they may be recorded or exposed through: - Shell history files. - Process inspection utilities and `/proc` interfaces. - Audit and endpoint-monitoring systems. - CI/CD command logs. - Container or orchestration metadata. - Debug output and command wrappers. A recovery mnemonic grants full and generally irreversible control over the wallet. A disclosed password can be combined with access to `keystore.enc` to decrypt the mnemonic. Although environment variables are preferable to command-line arguments in some environments, they may also be exposed through process inspection, crash reports, or deployment configuration. The declared wallet functionality requires access to these secrets, but it does not require placing them in globally observable command-line metadata. ### Attack Path 1. A user or automated Agent executes a command such as: ```bash clawpurse import --mnemonic "word1 word2 ..." --password "wallet- ...[truncated 1038 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for `--password` and `--mnemonic` command-line arguments. 2. Implement a masked interactive password prompt using Enquirer or a dedicated secure-prompt library. 3. Accept mnemonics through a protected interactive prompt, an explicitly opened file descriptor, or standard input only when the caller confirms that stdin is not being logged. 4. Consider integration with operating-system credential stores for unattended operation. 5. Retain environment-variable support only when necessary for automation and display a clear warning that environment variables are not universally confidential. 6. Ensure documentation and examples no longer encourage secret-bearing command-line flags. 7. Add tests that reject `--password` and `--mnemonic` and verify that secrets do not appear in logs or error messages. 8. Minimize the lifetime of decrypted mnemonic and password values and avoid including them in exception contexts. ]]>